sea-dev 1.0.0

package/libs/dal/src/submission.test.ts

@@ -0,0 +1,1304 @@
+import { resetTestDb } from "@/_tests/mock-db"; // Must always be the first import
+
+import { db, schema } from "@sea/db";
+import { eq } from "drizzle-orm";
+import { beforeEach, describe, expect, it } from "vitest";
+import {
+  addSubmissionGroupRow,
+  getDenormSubmission,
+  getSubmission,
+  getSubmissionGroup,
+  resetSubmission,
+  syncSubmissionToForm,
+  updateSubmissionValue,
+} from "./submission";
+
+describe("dbtest: addSubmissionGroupRow", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents adding submission group rows across organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-addsubmissiongrouprow@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-addsubmissiongrouprow@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create form groups for both organizations (multi=true for testing)
+    const [formGroup1, formGroup2] = await db
+      .insert(schema.formGroup)
+      .values([
+        {
+          formId: form1!.id,
+          name: "Group 1",
+          multi: true,
+          order: 0,
+        },
+        {
+          formId: form2!.id,
+          name: "Group 2",
+          multi: true,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create deals for both organizations
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions for both organizations
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          status: "draft",
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          status: "draft",
+        },
+      ])
+      .returning();
+
+    // Try to add a submission group row for org2's submission using member1
+    // This should fail because member1 doesn't have access to org2's formgroup
+    await expect(
+      addSubmissionGroupRow({
+        member: member1!,
+        submissionId: submission2!.id,
+        formGroupId: formGroup2!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Verify no submission group was created for org2's submission
+    const org2SubmissionGroups = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission2!.id),
+    });
+    expect(org2SubmissionGroups).toHaveLength(0);
+
+    // Now add a submission group row for org1's submission using member1 (should work)
+    const result = await addSubmissionGroupRow({
+      member: member1!,
+      submissionId: submission1!.id,
+      formGroupId: formGroup1!.id,
+    });
+
+    expect(result).toBeDefined();
+    expect(result.submissionId).toBe(submission1!.id);
+    expect(result.formGroupId).toBe(formGroup1!.id);
+
+    // Verify the submission group was created for org1's submission
+    const org1SubmissionGroups = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission1!.id),
+    });
+    expect(org1SubmissionGroups).toHaveLength(1);
+    expect(org1SubmissionGroups[0]!.formGroupId).toBe(formGroup1!.id);
+  });
+});
+
+describe("dbtest: getSubmissionGroup", () => {
+  // TODO CLAUDE 2025-07-17: The function checks organizationId on the submission table to ensure proper access control. The submissionGroupId filter is applied within the `with` clause, which means it only returns groups that belong to the already organization-validated submission. This approach is secure as it leverages the relational constraint that submission groups belong to submissions.
+
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents accessing submission groups across organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-getsubmissiongroup@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-getsubmissiongroup@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create form groups for both organizations
+    const [formGroup1, formGroup2] = await db
+      .insert(schema.formGroup)
+      .values([
+        {
+          formId: form1!.id,
+          name: "Group 1",
+          multi: false,
+          order: 0,
+        },
+        {
+          formId: form2!.id,
+          name: "Group 2",
+          multi: false,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create deals for both organizations
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions for both organizations
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          status: "draft",
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          status: "draft",
+        },
+      ])
+      .returning();
+
+    // Create submission groups for both organizations
+    const [submissionGroup1, submissionGroup2] = await db
+      .insert(schema.submissionGroup)
+      .values([
+        {
+          submissionId: submission1!.id,
+          formGroupId: formGroup1!.id,
+          order: 0,
+        },
+        {
+          submissionId: submission2!.id,
+          formGroupId: formGroup2!.id,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Try to get org2's submission group using member1 (should fail)
+    await expect(
+      getSubmissionGroup({
+        member: member1!,
+        submissionId: submission2!.id,
+        submissionGroupId: submissionGroup2!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Try to get org1's submission group with org2's submission ID using member1 (should fail)
+    await expect(
+      getSubmissionGroup({
+        member: member1!,
+        submissionId: submission2!.id,
+        submissionGroupId: submissionGroup1!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Get org1's submission group using member1 (should work)
+    const result = await getSubmissionGroup({
+      member: member1!,
+      submissionId: submission1!.id,
+      submissionGroupId: submissionGroup1!.id,
+    });
+
+    expect(result).toBeDefined();
+    expect(result.id).toBe(submissionGroup1!.id);
+    expect(result.submissionId).toBe(submission1!.id);
+    expect(result.formGroupId).toBe(formGroup1!.id);
+  });
+});
+
+describe("dbtest: syncSubmissionSchema", () => {
+  // TODO CLAUDE 2025-07-17: The function checks organizationId on the submission table to ensure the member has access to the submission. However, there's a potential concern that the function creates new submissionGroup and submissionItem records without explicitly validating that these new records maintain proper organizational boundaries. The function relies on the existing submission's organizationId check and the fact that form groups and items are already associated with that organization through the schema hierarchy.
+
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents syncing submission schema across organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-syncsubmissionschema@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-syncsubmissionschema@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create form groups for both organizations
+    const [formGroup1, formGroup2] = await db
+      .insert(schema.formGroup)
+      .values([
+        {
+          formId: form1!.id,
+          name: "Group 1",
+          multi: false,
+          order: 0,
+        },
+        {
+          formId: form2!.id,
+          name: "Group 2",
+          multi: false,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create form fields for both organizations
+    const [formField1, _formField2] = await db
+      .insert(schema.formField)
+      .values([
+        {
+          formGroupId: formGroup1!.id,
+          name: "Item 1",
+          type: "string",
+          order: 0,
+        },
+        {
+          formGroupId: formGroup2!.id,
+          name: "Item 2",
+          type: "string",
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create deals for both organizations
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions for both organizations
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          status: "draft",
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          status: "draft",
+        },
+      ])
+      .returning();
+
+    // Try to sync submission schema for org2's submission using member1
+    // This should fail because member1 doesn't have access to org2's submission
+    await expect(
+      syncSubmissionToForm({
+        member: member1!,
+        submissionId: submission2!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Verify no submission groups were created for org2's submission
+    const org2SubmissionGroups = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission2!.id),
+    });
+    expect(org2SubmissionGroups).toHaveLength(0);
+
+    // Now sync submission schema for org1's submission using member1 (should work)
+    await syncSubmissionToForm({
+      member: member1!,
+      submissionId: submission1!.id,
+    });
+
+    // Verify the submission group was created for org1's submission
+    const org1SubmissionGroups = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission1!.id),
+    });
+    expect(org1SubmissionGroups).toHaveLength(1);
+    expect(org1SubmissionGroups[0]!.formGroupId).toBe(formGroup1!.id);
+
+    // Verify the submission item was created for org1's submission
+    const org1SubmissionItems = await db.query.submissionItem.findMany({
+      where: eq(schema.submissionItem.submissionGroupId, org1SubmissionGroups[0]!.id),
+    });
+    expect(org1SubmissionItems).toHaveLength(1);
+    expect(org1SubmissionItems[0]!.formFieldId).toBe(formField1!.id);
+  });
+});
+
+describe("dbtest: getSubmission", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents accessing submissions across organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-getsubmission@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-getsubmission@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create deals for both organizations
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions for both organizations
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          status: "draft",
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          status: "draft",
+        },
+      ])
+      .returning();
+
+    // Try to get org2's submission using member1 (should fail)
+    await expect(
+      getSubmission({
+        member: member1!,
+        submissionId: submission2!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Get org1's submission using member1 (should work)
+    const result = await getSubmission({
+      member: member1!,
+      submissionId: submission1!.id,
+    });
+
+    expect(result).toBeDefined();
+    expect(result.id).toBe(submission1!.id);
+    expect(result.organizationId).toBe(org1!.id);
+    expect(result.formId).toBe(form1!.id);
+    expect(result.dealId).toBe(deal1!.id);
+    expect(result.conversationId).toBe(conversation1!.id);
+    expect(result.status).toBe("draft");
+  });
+});
+
+describe("dbtest: updateSubmissionValue", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents updating submission values across organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-updatesubmissionvalue@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-updatesubmissionvalue@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create form groups for both organizations
+    const [formGroup1, formGroup2] = await db
+      .insert(schema.formGroup)
+      .values([
+        {
+          formId: form1!.id,
+          name: "Group 1",
+          multi: false,
+          order: 0,
+        },
+        {
+          formId: form2!.id,
+          name: "Group 2",
+          multi: false,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create form fields for both organizations
+    const [formField1, formField2] = await db
+      .insert(schema.formField)
+      .values([
+        {
+          formGroupId: formGroup1!.id,
+          name: "Item 1",
+          type: "string",
+          order: 0,
+        },
+        {
+          formGroupId: formGroup2!.id,
+          name: "Item 2",
+          type: "string",
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create deals for both organizations
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions for both organizations
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          status: "draft",
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          status: "draft",
+        },
+      ])
+      .returning();
+
+    // Create submission groups for both organizations
+    const [submissionGroup1, submissionGroup2] = await db
+      .insert(schema.submissionGroup)
+      .values([
+        {
+          submissionId: submission1!.id,
+          formGroupId: formGroup1!.id,
+          order: 0,
+        },
+        {
+          submissionId: submission2!.id,
+          formGroupId: formGroup2!.id,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create submission items for both organizations
+    const [submissionItem1, submissionItem2] = await db
+      .insert(schema.submissionItem)
+      .values([
+        {
+          submissionGroupId: submissionGroup1!.id,
+          formFieldId: formField1!.id,
+        },
+        {
+          submissionGroupId: submissionGroup2!.id,
+          formFieldId: formField2!.id,
+        },
+      ])
+      .returning();
+
+    // Try to update org2's submission item using member1 (should fail)
+    await expect(
+      updateSubmissionValue({
+        member: member1!,
+        submissionItemId: submissionItem2!.id,
+        value: "unauthorized update",
+      }),
+    ).rejects.toThrow();
+
+    // Verify no version was created for org2's submission item
+    const org2ItemVersions = await db.query.submissionItemVersion.findMany({
+      where: eq(schema.submissionItemVersion.submissionItemId, submissionItem2!.id),
+    });
+    expect(org2ItemVersions).toHaveLength(0);
+
+    // Update org1's submission item using member1 (should work)
+    await updateSubmissionValue({
+      member: member1!,
+      submissionItemId: submissionItem1!.id,
+      value: "authorized update",
+    });
+
+    // Verify the version was created for org1's submission item
+    const org1ItemVersions = await db.query.submissionItemVersion.findMany({
+      where: eq(schema.submissionItemVersion.submissionItemId, submissionItem1!.id),
+    });
+    expect(org1ItemVersions).toHaveLength(1);
+    expect(org1ItemVersions[0]!.value).toBe("authorized update");
+    expect(org1ItemVersions[0]!.selected).toBe(true);
+    expect(org1ItemVersions[0]!.sourceType).toBe("manual");
+  });
+});
+
+describe("dbtest: resetSubmission", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents resetting submissions across organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-resetsubmission@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-resetsubmission@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+        },
+      ])
+      .returning();
+
+    // Create form groups for both organizations (multi=true for testing)
+    const [formGroup1, formGroup2] = await db
+      .insert(schema.formGroup)
+      .values([
+        {
+          formId: form1!.id,
+          name: "Group 1",
+          multi: true,
+          order: 0,
+        },
+        {
+          formId: form2!.id,
+          name: "Group 2",
+          multi: true,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create form fields for both organizations
+    const [formField1, formField2] = await db
+      .insert(schema.formField)
+      .values([
+        {
+          formGroupId: formGroup1!.id,
+          name: "Item 1",
+          type: "string",
+          order: 0,
+        },
+        {
+          formGroupId: formGroup2!.id,
+          name: "Item 2",
+          type: "string",
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create deals for both organizations
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions for both organizations
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          status: "draft",
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          status: "draft",
+        },
+      ])
+      .returning();
+
+    // Create submission groups for both organizations
+    const [submissionGroup1, submissionGroup2] = await db
+      .insert(schema.submissionGroup)
+      .values([
+        {
+          submissionId: submission1!.id,
+          formGroupId: formGroup1!.id,
+          order: 0,
+        },
+        {
+          submissionId: submission2!.id,
+          formGroupId: formGroup2!.id,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create submission items for both organizations
+    const [submissionItem1, submissionItem2] = await db
+      .insert(schema.submissionItem)
+      .values([
+        {
+          submissionGroupId: submissionGroup1!.id,
+          formFieldId: formField1!.id,
+        },
+        {
+          submissionGroupId: submissionGroup2!.id,
+          formFieldId: formField2!.id,
+        },
+      ])
+      .returning();
+
+    // Create submission item versions for both organizations
+    await db.insert(schema.submissionItemVersion).values([
+      {
+        submissionItemId: submissionItem1!.id,
+        sourceType: "manual",
+        value: "test value 1",
+        selected: true,
+      },
+      {
+        submissionItemId: submissionItem2!.id,
+        sourceType: "manual",
+        value: "test value 2",
+        selected: true,
+      },
+    ]);
+
+    // Verify initial state: both organizations have data
+    const initialOrg1Versions = await db.query.submissionItemVersion.findMany({
+      where: eq(schema.submissionItemVersion.submissionItemId, submissionItem1!.id),
+    });
+    const initialOrg2Versions = await db.query.submissionItemVersion.findMany({
+      where: eq(schema.submissionItemVersion.submissionItemId, submissionItem2!.id),
+    });
+    const initialOrg1Groups = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission1!.id),
+    });
+    const initialOrg2Groups = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission2!.id),
+    });
+
+    expect(initialOrg1Versions).toHaveLength(1);
+    expect(initialOrg2Versions).toHaveLength(1);
+    expect(initialOrg1Groups).toHaveLength(1);
+    expect(initialOrg2Groups).toHaveLength(1);
+
+    // Try to reset org2's submission using member1 (should silently do nothing due to organization check)
+    await resetSubmission({
+      member: member1!,
+      submissionId: submission2!.id,
+    });
+
+    // Verify org2's data is unchanged
+    const org2VersionsAfterReset = await db.query.submissionItemVersion.findMany({
+      where: eq(schema.submissionItemVersion.submissionItemId, submissionItem2!.id),
+    });
+    const org2GroupsAfterReset = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission2!.id),
+    });
+
+    expect(org2VersionsAfterReset).toHaveLength(1);
+    expect(org2GroupsAfterReset).toHaveLength(1);
+
+    // Reset org1's submission using member1 (should work)
+    await resetSubmission({
+      member: member1!,
+      submissionId: submission1!.id,
+    });
+
+    // Verify org1's data is reset
+    const org1VersionsAfterReset = await db.query.submissionItemVersion.findMany({
+      where: eq(schema.submissionItemVersion.submissionItemId, submissionItem1!.id),
+    });
+    const org1GroupsAfterReset = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission1!.id),
+    });
+
+    expect(org1VersionsAfterReset).toHaveLength(0);
+    expect(org1GroupsAfterReset).toHaveLength(0);
+
+    // Verify org2's data is still unchanged
+    const org2VersionsFinal = await db.query.submissionItemVersion.findMany({
+      where: eq(schema.submissionItemVersion.submissionItemId, submissionItem2!.id),
+    });
+    const org2GroupsFinal = await db.query.submissionGroup.findMany({
+      where: eq(schema.submissionGroup.submissionId, submission2!.id),
+    });
+
+    expect(org2VersionsFinal).toHaveLength(1);
+    expect(org2GroupsFinal).toHaveLength(1);
+  });
+});
+
+describe("dbtest: getDenormSubmission", () => {
+  beforeEach(async () => {
+    await resetTestDb();
+  });
+
+  it("prevents accessing denormalized submissions across organizations", async () => {
+    // Create two organizations
+    const [org1, org2] = await db
+      .insert(schema.organization)
+      .values([{ name: "Org 1" }, { name: "Org 2" }])
+      .returning();
+
+    // Create users for both organizations
+    const [user1, user2] = await db
+      .insert(schema.user)
+      .values([
+        { name: "User 1", email: "user1-getdenormsubmission@example.com", emailVerified: true },
+        { name: "User 2", email: "user2-getdenormsubmission@example.com", emailVerified: true },
+      ])
+      .returning();
+
+    // Create members for both organizations
+    const [member1, _member2] = await db
+      .insert(schema.member)
+      .values([
+        { organizationId: org1!.id, userId: user1!.id, role: "member" },
+        { organizationId: org2!.id, userId: user2!.id, role: "member" },
+      ])
+      .returning();
+
+    // Create conversations for both organizations
+    const [conversation1, conversation2] = await db
+      .insert(schema.conversation)
+      .values([
+        { organizationId: org1!.id, model: "gpt-4.1" },
+        { organizationId: org2!.id, model: "gpt-4.1" },
+      ])
+      .returning();
+
+    // Create workflow for both organizations
+    const [workflow1, workflow2] = await db
+      .insert(schema.workflow)
+      .values([
+        { organizationId: org1!.id, name: "Workflow 1" },
+        { organizationId: org2!.id, name: "Workflow 2" },
+      ])
+      .returning();
+
+    // Create forms for both organizations
+    const [form1, form2] = await db
+      .insert(schema.form)
+      .values([
+        {
+          workflowId: workflow1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "form 1",
+          hint: "Test hint 1",
+        },
+        {
+          workflowId: workflow2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "form 2",
+          hint: "Test hint 2",
+        },
+      ])
+      .returning();
+
+    // Create form groups for both organizations
+    const [formGroup1, formGroup2] = await db
+      .insert(schema.formGroup)
+      .values([
+        {
+          formId: form1!.id,
+          name: "Group 1",
+          multi: false,
+          hint: "Group hint 1",
+          order: 0,
+        },
+        {
+          formId: form2!.id,
+          name: "Group 2",
+          multi: false,
+          hint: "Group hint 2",
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create form fields for both organizations
+    const [formField1, formField2] = await db
+      .insert(schema.formField)
+      .values([
+        {
+          formGroupId: formGroup1!.id,
+          name: "Item 1",
+          type: "string",
+          hint: "Item hint 1",
+          order: 0,
+        },
+        {
+          formGroupId: formGroup2!.id,
+          name: "Item 2",
+          type: "string",
+          hint: "Item hint 2",
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create deals for both organizations
+    const [deal1, deal2] = await db
+      .insert(schema.deal)
+      .values([
+        { organizationId: org1!.id, name: "Deal 1" },
+        { organizationId: org2!.id, name: "Deal 2" },
+      ])
+      .returning();
+
+    // Create submissions for both organizations
+    const [submission1, submission2] = await db
+      .insert(schema.submission)
+      .values([
+        {
+          formId: form1!.id,
+          dealId: deal1!.id,
+          organizationId: org1!.id,
+          conversationId: conversation1!.id,
+          name: "Submission 1",
+          summary: "Summary 1",
+          status: "draft",
+        },
+        {
+          formId: form2!.id,
+          dealId: deal2!.id,
+          organizationId: org2!.id,
+          conversationId: conversation2!.id,
+          name: "Submission 2",
+          summary: "Summary 2",
+          status: "draft",
+        },
+      ])
+      .returning();
+
+    // Create submission groups for both organizations
+    const [submissionGroup1, submissionGroup2] = await db
+      .insert(schema.submissionGroup)
+      .values([
+        {
+          submissionId: submission1!.id,
+          formGroupId: formGroup1!.id,
+          order: 0,
+        },
+        {
+          submissionId: submission2!.id,
+          formGroupId: formGroup2!.id,
+          order: 0,
+        },
+      ])
+      .returning();
+
+    // Create submission items for both organizations
+    const [submissionItem1, submissionItem2] = await db
+      .insert(schema.submissionItem)
+      .values([
+        {
+          submissionGroupId: submissionGroup1!.id,
+          formFieldId: formField1!.id,
+        },
+        {
+          submissionGroupId: submissionGroup2!.id,
+          formFieldId: formField2!.id,
+        },
+      ])
+      .returning();
+
+    // Create submission item versions for both organizations
+    await db.insert(schema.submissionItemVersion).values([
+      {
+        submissionItemId: submissionItem1!.id,
+        sourceType: "manual",
+        value: "test value 1",
+        selected: true,
+      },
+      {
+        submissionItemId: submissionItem2!.id,
+        sourceType: "manual",
+        value: "test value 2",
+        selected: true,
+      },
+    ]);
+
+    // Try to get org2's denormalized submission using member1 (should fail)
+    await expect(
+      getDenormSubmission({
+        member: member1!,
+        submissionId: submission2!.id,
+      }),
+    ).rejects.toThrow();
+
+    // Get org1's denormalized submission using member1 (should work)
+    const result = await getDenormSubmission({
+      member: member1!,
+      submissionId: submission1!.id,
+    });
+
+    expect(result).toBeDefined();
+    expect(result.id).toBe(submission1!.id);
+    expect(result.name).toBe("Submission 1");
+    expect(result.summary).toBe("Summary 1");
+    expect(result.formName).toBe("form 1");
+    expect(result.hint).toBe("Test hint 1");
+    expect(result.groups).toHaveLength(1);
+    expect(result.groups[0]!.id).toBe(submissionGroup1!.id);
+    expect(result.groups[0]!.name).toBe("Group 1");
+    expect(result.groups[0]!.multi).toBe(false);
+    expect(result.groups[0]!.hint).toBe("Group hint 1");
+    expect(result.groups[0]!.items).toHaveLength(1);
+    expect(result.groups[0]!.items[0]!.id).toBe(submissionItem1!.id);
+    expect(result.groups[0]!.items[0]!.name).toBe("Item 1");
+    expect(result.groups[0]!.items[0]!.type).toBe("string");
+    expect(result.groups[0]!.items[0]!.hint).toBe("Item hint 1");
+    expect(result.groups[0]!.items[0]!.value).toBe("test value 1");
+  });
+});